CVE-2026-24898

CVSS v3 10.0 CRITICAL

10.0^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

O

penEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0, an unauthenticated token disclosure vulnerability in the MedEx callback endpoint allows any unauthenticated visitor to obtain the practice's MedEx API tokens, leading to complete third-party service compromise, PHI exfiltration, unauthorized actions on the MedEx platform, and HIPAA violations. The vulnerability exists because the endpoint bypasses authentication ($ignoreAuth = true) and performs a MedEx login whenever $_POST['callback_key'] is provided, returning the full JSON response including sensitive API tokens. This vulnerability is fixed in 8.0.0.

References

Link	Resource
https://github.com/openemr/openemr/commit/8e4de59ab58222f13abc4e4040128737d857db9c	Patch
https://github.com/openemr/openemr/security/advisories/GHSA-qwff-3mw7-7rc7	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*

History

04 Mar 2026, 21:57

Type	Values Removed	Values Added
First Time		Open-emr openemr Open-emr
CPE		cpe:2.3:a:open-emr:openemr::::::::
References	~~() https://github.com/openemr/openemr/commit/8e4de59ab58222f13abc4e4040128737d857db9c -~~	() https://github.com/openemr/openemr/commit/8e4de59ab58222f13abc4e4040128737d857db9c - Patch
References	~~() https://github.com/openemr/openemr/security/advisories/GHSA-qwff-3mw7-7rc7 -~~	() https://github.com/openemr/openemr/security/advisories/GHSA-qwff-3mw7-7rc7 - Exploit, Vendor Advisory

03 Mar 2026, 22:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-03-03 22:16

Updated : 2026-03-04 21:57

NVD link : CVE-2026-24898

Mitre link : CVE-2026-24898

CVE.ORG link : CVE-2026-24898

JSON object : View

Products Affected

openemr

CWE

CWE-287

Improper Authentication

{"id": "CVE-2026-24898", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 10.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2026-03-03T22:16:28.443", "references": [{"url": "https://github.com/openemr/openemr/commit/8e4de59ab58222f13abc4e4040128737d857db9c", "tags": ["Patch"], "source": "[email protected]"}, {"url": "https://github.com/openemr/openemr/security/advisories/GHSA-qwff-3mw7-7rc7", "tags": ["Exploit", "Vendor Advisory"], "source": "[email protected]"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0, an unauthenticated token disclosure vulnerability in the MedEx callback endpoint allows any unauthenticated visitor to obtain the practice's MedEx API tokens, leading to complete third-party service compromise, PHI exfiltration, unauthorized actions on the MedEx platform, and HIPAA violations. The vulnerability exists because the endpoint bypasses authentication ($ignoreAuth = true) and performs a MedEx login whenever $_POST['callback_key'] is provided, returning the full JSON response including sensitive API tokens. This vulnerability is fixed in 8.0.0."}], "lastModified": "2026-03-04T21:57:13.603", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FEAA9896-A42E-437C-BEE8-8DA955E34385", "versionEndExcluding": "8.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}